Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2025-04-08 02:34:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2715 from testssl/sanitze_better_http_header.3.0

Browse Source 
Remove inherited double line
This commit is contained in:
Dirk Wetter 2025-03-20 14:23:00 +01:00 committed by GitHub
commit 6a4a96c342
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
testssl.sh
View File

@ -2196,15 +2196,10 @@ connectivity_problem() {
} }
sanitze_http_header() { sanitze_http_header() {
# Quit on first empty line to catch 98% of the cases. Next pattern is there because the SEDs tested # sed implementations tested were sometime not fine with header containing x0d x0a (CRLF) which is the usual
# so far seem not to be fine with header containing x0d x0a (CRLF) which is the usual case. # case. Also we use tr here to remove any crtl chars which the server side offers --> possible security problem
# So we also trigger also on any sign on a single line which is not alphanumeric (plus _) # Only allowed now is LF + CR. See #2337. awk OTOH, see above, doesn't seem to care -- but not under MacOS
#
# Also we use tr here to remove any crtl chars which the server side offers --> possible security problem
# Only allowed now is LF + CR. See #2337
# awk, see above, doesn't seem to care
sed -e '/^$/q' -e '/^[^a-zA-Z_0-9]$/q' $HEADERFILE | tr -d '\000-\011\013\014\016-\037' >$HEADERFILE.tmp sed -e '/^$/q' -e '/^[^a-zA-Z_0-9]$/q' $HEADERFILE | tr -d '\000-\011\013\014\016-\037' >$HEADERFILE.tmp
sed -e '/^$/q' -e '/^[^a-zA-Z_0-9]$/q' $HEADERFILE | tr -d '\000-\010\013\014\016-\037' >$HEADERFILE.tmp
# Now to be more sure we delete from '<' or '{' maybe with a leading blank until the end # Now to be more sure we delete from '<' or '{' maybe with a leading blank until the end
sed -e '/^ *<.*$/d' -e '/^ *{.*$/d' $HEADERFILE.tmp >$HEADERFILE sed -e '/^ *<.*$/d' -e '/^ *{.*$/d' $HEADERFILE.tmp >$HEADERFILE
debugme echo -e "---\n $(< $HEADERFILE) \n---" debugme echo -e "---\n $(< $HEADERFILE) \n---"